Managing user privileges is fundamental to Linux system administration. Two commands commonly used to perform administrative tasks are sudo and su. Although both allow users to operate with elevated privileges, they differ in how they authenticate users, grant access, and manage administrative sessions.

Understanding these differences helps you maintain better security, minimize unnecessary root access, and administer Linux systems more effectively.

1. What Is Root?

In Linux, root is the superuser account, equivalent to the system administrator with unrestricted privileges. Unlike ordinary users, root can access and modify virtually any file, change system configurations, manage user accounts, and control system services.

With root privileges, you can:

• Create, modify, and delete files regardless of their ownership or permissions.
• Install, update, and remove software.
• Manage users, groups, and access permissions.
• Configure system services and networking.
• Mount and unmount filesystems.
• Modify storage devices and filesystems.
• Change critical system settings.

This level of access makes root essential for system administration, but it also introduces significant risks.

Linux does not automatically protect you from every destructive action performed as root. A command executed with unrestricted privileges can damage the system without providing an additional confirmation prompt.

For example:

$ sudo rm -rf /some/directory

This command recursively deletes the specified directory and its contents without prompting for confirmation. If executed against the wrong path, it can destroy important data.

The risk is even greater when running commands as root because ordinary filesystem permission restrictions no longer provide the same protection.

Best practice: Use administrative privileges only when necessary, verify destructive commands before executing them, and avoid running your entire working environment as root.

2. What Is sudo?

sudo, traditionally expanded as superuser do, allows authorized users to execute commands with the privileges of another user, usually root.

Instead of switching to the root account, you can execute individual administrative commands from your existing user session.

For example, to update the package lists on Ubuntu or Debian:

$ sudo apt update

The command typically prompts for your own password, not the root password. Depending on the system configuration, you may not be prompted again for a short period after successful authentication.

The command runs with root privileges when permitted by the applicable sudoers policy.

Key characteristics of sudo

• Command-level privilege escalation: Execute individual commands with elevated privileges.
• Configurable access control: Administrators can specify which users may execute which commands.
• Auditability: Sudo records information about privileged command execution, typically in system logs.
• Reduced exposure: You can perform administrative tasks without maintaining a persistent root shell.
• Flexible execution: Commands can run as root or as another permitted user.

For example, to edit a system configuration file:

$ sudo nano /etc/ssh/sshd_config

To restart the SSH service:

$ sudo systemctl restart ssh

Each command is executed with the privileges required for that operation, subject to the configured policy.

Important: sudo does not inherently guarantee that every command is safe. An authorized user can still damage a system, and granting unrestricted sudo access effectively gives that user root-level control.

Useful sudo options

For example, to inspect a command's permitted sudo access:

$ sudo -l

This is particularly useful when troubleshooting administrative permissions.

3. What Is su?

su, short for substitute user, allows you to switch to another user account.

When used without specifying a username, it attempts to switch to root.

$ su

On a typical Linux system, you will be prompted for the root password. If authentication succeeds, you obtain a shell running as root.

Unlike running a single command through sudo, this shell can remain active while you execute multiple commands.

For example:

$ su
$ apt update
$ systemctl status ssh
$ exit

The commands between su and exit run as root, assuming the switch was successful and you have not changed identities again.

Switching to another user

You can also use su to switch to a specific account:

$ su rover

This starts a shell as rover, normally retaining aspects of the current environment.

To start a login shell for that user, use:

$ su - rover

The - option initializes the target user's login environment, including the appropriate environment variables and working directory.

If you are switching from an ordinary account, you generally need the target user's password. However, root can normally switch to another user without supplying that user's password.

Key characteristics of su

• User switching: Switch to root or another user account.
• Persistent sessions: Remain in the target user's shell until you exit.
• Authentication: Typically requires the target user's password when switching from an ordinary account.
• Environment control: The - option initializes the target user's login environment.
• Broad administrative access: A root shell allows multiple administrative operations without repeatedly invoking sudo.

Important distinction: su does not inherently provide root privileges. The privileges you receive depend on the account you switch to.

4. sudo vs. su: Key Differences

Although both commands can provide access to root privileges, their behavior differs.

One important clarification: sudo can also start a persistent root shell through sudo -i, while su can switch to ordinary users without granting root privileges.

The distinction is therefore not simply that one command is temporary and the other is permanent. The key difference is how they authenticate, authorize, and establish the target user's execution context.

5. When Should You Use sudo or su?

Use sudo when:

• You need to execute an individual administrative command.
• You want to avoid entering a persistent root shell.
• You need access controlled by a centralized sudoers policy.
• You want privileged command execution to be more easily auditable.
• You are administering Ubuntu, Debian, or another system configured around sudo.

For example:

$ sudo apt update
$ sudo apt upgrade
$ sudo systemctl restart nginx

Each command runs with the necessary privileges, assuming your sudo policy permits it.

Use su when:

• You need to switch to another user account.
• You need a persistent shell under a different identity.
• You are working on a system where root authentication is the established administrative method.
• You need to test a user's login environment or troubleshoot account-specific behavior.

For example:

$ su - www-data

This attempts to start a login shell as www-data, subject to the account's configuration and shell restrictions.

If you need a root login shell instead:

$ su -

This starts a root login shell after successful authentication.

Practical recommendation: For routine administration, prefer sudo where it is properly configured. Use su when switching identities is the actual objective or when a persistent shell is justified.

6. Security Considerations

Both commands can be used securely, but neither eliminates the risks associated with privileged access.

Why sudo is often preferred

1. Granular authorization

Administrators can restrict sudo access to specific commands or operations rather than granting unrestricted root access.

For example, a user might be permitted to restart a particular service without being allowed to modify the entire system.

2. Better command-level auditing

Sudo commonly records privileged command execution, providing useful information for troubleshooting and security investigations.

However, logging behavior depends on the configuration. Standard sudo logs do not necessarily capture every detail of a command's activity or everything displayed in its terminal.

3. Reduced exposure to accidental damage

Running administrative commands individually reduces the time spent working in a privileged shell.

This is particularly valuable when managing production servers, remote infrastructure, and systems containing sensitive data.

Risks associated with both commands

Regardless of which command you use:

• Avoid executing commands from untrusted sources with elevated privileges.
• Do not grant unrestricted sudo access without a legitimate operational requirement.
• Protect root credentials and user passwords.
• Review sudoers rules and remove unnecessary privileges.
• Avoid leaving privileged shells open when they are no longer needed.
• Verify filesystem paths and command arguments before performing destructive operations.

On systems that support it, review sudo permissions with:

$ sudo -l

Administrators can inspect the sudo policy using:

$ sudo visudo

Use visudo rather than editing /etc/sudoers directly. It validates the configuration before saving changes, helping prevent syntax errors that could disrupt administrative access.

7. Why su May Not Work on Ubuntu

A common source of confusion is that Ubuntu installations typically do not assign a usable password to the root account by default.

Consequently, attempting:

$ su -

may fail because root password authentication has not been configured.

This does not mean root is disabled or inaccessible. An authorized user can normally obtain root privileges through sudo:

$ sudo -i

This starts an interactive root login shell using sudo authorization.

When finished, leave the root shell with:

$ exit

You can also run a single command as root without opening a persistent shell:

$ sudo command

Security recommendation: On Ubuntu, there is generally no need to enable root password authentication simply to perform administrative tasks. The default sudo-based model is sufficient for most administration workflows.

Both sudo and su are essential Linux tools for managing user privileges.

• sudo executes commands with another user's privileges, usually root.
• su switches to another user and starts a shell under that account.
• sudo -i opens a root login shell using sudo authorization.
• su - opens a root login shell when root authentication is available.

For routine administration, sudo generally offers better access control and accountability. Regardless of the method, follow the principle of least privilege to minimize security risks.

We hope this was helpful!